Keycloak: Remote Code Execution in client management component (CVE-2026-120984)
An authenticated attacker with client management permissions can exploit a session attribute flaw in Keycloak to upload and execute arbitrary JavaScript policies on the server.
CVE search metadata
CVE search record: CVE-2026-120984. Severity: critical. CVSS: 9.1. KEV: no. Product: Keycloak. Brief: Keycloak: Remote Code Execution in client management component (CVE-2026-120984). Brief link: https://feed.craftedsignal.io/briefs/2026-11-keycloak-rce/
Triage facts
Revision 2- Applicability
- Keycloak
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 7, 17:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
A vulnerability exists in the Keycloak client management component where authorization services fail to clear an internal session attribute when a client is created or imported with authorization services enabled. This flaw allows an authenticated user with client management privileges to inject and execute arbitrary JavaScript policies during an authorization request. Successful exploitation leads to remote code execution on the server.
Impact
An authenticated attacker can execute arbitrary JavaScript on the Keycloak server, potentially leading to full system compromise.
Recommendation
- Identify all Keycloak instances within the organization.
- Review administrative logs for accounts with client management permissions that have recently created or imported clients.
- Monitor for authorization service policy modifications or the addition of suspicious JavaScript policies.
- Upgrade Keycloak to the vendor-provided patched version once available to address CVE-2026-120984.
Immediate actions
Audit administrative accounts with client management permissions
Threat Hunt
Identify unusual policy uploads or modifications in Keycloak authorization service logs
Data: Keycloak audit logs, Application server request logs
Mitigations
Apply security patch for CVE-2026-120984 when released by Red Hat
CVE-2026-120984